Intermittent 403 Error When Sending API Requests to ServiceNow InstanceIssue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: block; max-width: ; width: auto; height: auto; } } When sending API requests to a ServiceNow instance, the requests sometimes reaches instance and sometimes return a 403 error. The error message received is: "User Not Authorized" with the detail "Failed API level ACL Validation". Symptoms<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: block; max-width: ; width: auto; height: auto; } } This is an intermittant issue where where we are restoring the user session on node switch but potentially not roles. As observed when customer is making the API calls from the same endpoint to servoicenow, few of them are sucessful and few get failed with 403 error. which usually means the client session is valid, but user does not have permissions to access the requested resource.This cannot be true as the same user has been able to access the API and is getting a successful 200 HTTP response for the same GET call.After verifing the logs, the user session is getting restored in the call and then failing with authorization error. 2025-08-26 15:19:36 (581) APIINT-thread-2 1234678910111ABC123456789ABC123 TimingLogger #20669 [REST API] RESTAPIProcessor : User Not Authorized2025-08-26 15:19:36 (580) APIINT-thread-2 1234678910111ABC123456789ABC123 txid=ab123456cd12 AProcessor Security restrictions on RESTAPIProcessor2025-08-26 15:19:36 (574) APIINT-thread-2 1234678910111ABC123456789ABC123 txid=ab123456cd12 StopWatch [0:00:00.002] Restored saved session records for AC7CD71E346766104EFD121D96221F2025-08-26 15:19:36 (572) APIINT-thread-2 1234678910111ABC123456789ABC123 txid=ab123456cd12 SavedUserSession Restoring saved session records for AC7CD71E346766104EFD121D96221F (607cd71e346766104efd121d96221fae)2025-08-26 15:19:36 (553) APIINT-thread-2 SYSTEM txid=ab123456cd12 Sessions Session user set to user1232025-08-26 15:19:36 (553) APIINT-thread-2 SYSTEM txid=ab123456cd12 HTTPAuthSessionSetup HTTP authorization validated user ‘user123’ Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: block; max-width: ; width: auto; height: auto; } } Yokohama Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: block; max-width: ; width: auto; height: auto; } } The issue is with restoring sessions while the Explicit Roles plugin is enabled. Restoring sessions was enabled in Yokohama. Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: block; max-width: ; width: auto; height: auto; } } 1. Create a property in the sys_properties record with the name "glide.session.save_changes" and set the value to false. This will prevent the user session from being restored, which is causing the authorization error. 2. Test the API calls again to ensure the issue has been resolved and the 403 error no longer occurs. Related Links<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: #000000; } span { font-size: 12pt; font-family: Lato; color: #000000; } h2 { font-size: 24pt; font-family: Lato; color: black; } h3 { font-size: 18pt; font-family: Lato; color: black; } h4 { font-size: 14pt; font-family: Lato; color: black; } a { font-size: 12pt; font-family: Lato; color: #00718F; } a:hover { font-size: 12pt; color: #024F69; } a:target { font-size: 12pt; color: #032D42; } a:visited { font-size: 12pt; color: #00718f; } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: block; max-width: ; width: auto; height: auto; } } PRB1883480